troubleshoot-logstash

Diagnose Logstash operational issues by querying Netdata MCP health signals.

1|Updated Apr 17, 2026
One-click install
npx skills add https://github.com/netdata/skills --skill troubleshoot-logstash
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: troubleshoot-logstash
Source: https://github.com/netdata/skills/tree/main/skills/troubleshoot-logstash
Command: npx skills add https://github.com/netdata/skills --skill troubleshoot-logstash

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Diagnosing why Logstash is misbehaving (errors, latency, saturation, resource exhaustion, or unexpected restarts) by providing a structured triage workflow grounded in Netdata’s Logstash signals.

Core Features & Use Cases

  • Operator playbook-based diagnostic tree: Guides an AI coding agent to follow the same remediation logic used by the Netdata operator playbook, but with MCP queries to verify facts.
  • MCP-driven Logstash signal discovery and verification: Uses MCP to confirm the Logstash node exists, pull relevant logstash.* contexts over a window, and rank anomalies.
  • Remediation validation loop: Re-runs the same MCP queries after suggested remediation to ensure signals return to expected ranges.

Quick Start

Use the skill to troubleshoot an on-call incident by asking your AI: “Diagnose my Logstash problems using Netdata via MCP, verify the relevant logstash contexts, and recommend the safest remediation steps.”

Frequently Asked Questions about troubleshoot-logstash

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I troubleshoot Logstash operational issues like high latency or unexpected restarts?

To troubleshoot Logstash operational issues, you can use an AI agent to query Netdata via MCP for Logstash health signals and apply a diagnostic tree to validate metrics like elevated errors and resource exhaustion.

How does anomaly detection work for Logstash JVM metrics using Netdata?

Anomaly detection for Logstash JVM metrics works by querying Netdata via MCP to discover and rank anomalous `logstash.*` contexts, applying an operator playbook to correlate metrics within a defined time window.

What is the best way to triage Logstash saturation and resource exhaustion during an incident?

The best way to triage Logstash saturation is by following a structured diagnostic workflow that queries Netdata for JVM metrics, finds correlated anomalies, and recommends validated remediation steps.

Can I use MCP to verify Logstash remediation steps and validate that health signals return to normal?

Yes, you can use MCP to verify Logstash remediation by re-running the same query_metrics calls after suggested fixes to ensure health signals and JVM metrics return to their expected ranges.

Do I need Netdata to diagnose Logstash node errors and latency spikes?

Yes, diagnosing Logstash node errors and latency spikes with this workflow requires Netdata to provide the underlying JVM metrics and health signals accessed via MCP calls like list_nodes and find_anomalous_metrics.